WSL2 Kubernetes - How to mount local folder with specifying user/group rights - docker

Question

I am using WSL2 Debian and Docker Desktop and I want to persist my volume data within a local folder (a path to OneDrive in best case).
This works fine but with one exception, everything is owned by root:root. How can I specify the user/group permissions within the volume?
And is there any documentation for this anywhere?
apiVersion: apps/v1
kind: Deployment
metadata:
name: dummy-service
labels:
app: dummy-service
spec:
replicas: 3
selector:
matchLabels:
app: dummy-service
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 1
template:
metadata:
labels:
app: dummy-service
spec:
containers:
- name: dotnet
image: alpine
imagePullPolicy: Always
resources:
requests:
cpu: "100m"
memory: "40Mi"
limits:
memory: "64Mi"
ports:
- containerPort: 5000
volumeMounts:
- mountPath: "/app/wwwroot"
name: dummy-volume
readinessProbe:
httpGet:
path: /heartbeat
port: 5000
scheme: HTTP
initialDelaySeconds: 5
timeoutSeconds: 1
periodSeconds: 15
livenessProbe:
httpGet:
path: /heartbeat
port: 5000
scheme: HTTP
failureThreshold: 3
initialDelaySeconds: 10
periodSeconds: 15
successThreshold: 1
timeoutSeconds: 1
volumes:
- name: dummy-volume
persistentVolumeClaim:
claimName: dummy-pvc
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: dummy-sc
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: dummy-pv
spec:
capacity:
storage: 512Mi
accessModes:
- ReadWriteMany
persistentVolumeReclaimPolicy: Retain
storageClassName: dummy-sc
local:
path: /run/desktop/mnt/host/c/Users/Markus/OneDrive/Workspace/Volume/Web
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- docker-desktop
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: dummy-pvc
spec:
storageClassName: dummy-sc
accessModes:
- ReadWriteMany
resources:
requests:
storage: 512Mi

Answer 1

I can think of three possible solutions for this issue:
You could use the Init Containers. This way the container in a pod which is running as a non-root user can have permissions for the mounted volume. See the example below:
initContainers:
- name: set-permissions
image: <image_name>
# Give user id 555 permissions for the mounted volume
command:
- chown
- -R
- 555:555
- /var/lib/data
volumeMounts:
- name: data
mountPath: /var/lib/data
Another way to give the non-root user an access to the folder where it wants to read and write data is to follow the steps below:
Create user group and assign group ID in Dockerfile.
Create user with user ID and add to the group in Dockerfile.
Change ownership recursively for the folders the user process wants to read/write.
Add the following lines into your Deployment's Pod spec:
spec:
securityContext:
runAsUser: 1099
runAsGroup: 1099
fsGroup: 1099
As described in the docs:
runAsUser: Specifies that for any Containers in the Pod, all processes run with user ID 1099.
runAsGroup: Specifies the primary group ID of 1099 for all processes within any containers of the Pod. If this field is omitted, the primary group ID of the containers will be root(0). Any files created will also be owned by user 1099 and group 1099 when runAsGroup is specified.
fsGroup: Specifies the owner of any volume attached will be owner by group ID 1099.
Configure volume permission and ownership change policy for Pods (I know it does not suit your use case but I will leave this option here for other community members).